fad-checker 1.0.5 → 2.0.0

package/lib/cve-report.js

@@ -7,6 +7,7 @@
  */
 const fs = require("fs");
 const path = require("path");
+const { getCodec, allCodecs, ORDER } = require("./codecs");
 
 // CWE-id → short human name. Loaded once at module init. Unknown CWEs fall
 // back to the raw id (with a "—" placeholder name where the row asks for one).
@@ -132,6 +133,7 @@ code.path { font-family: ui-monospace, monospace; font-size: 0.9em; background:
 .exec-summary .exec-head { display: flex; align-items: center; gap: 12px; }
 .exec-summary .exec-level { font-size: 12px; font-weight: 700; letter-spacing: 1px; padding: 4px 12px; border-radius: 999px; }
 .exec-summary .exec-title { font-size: 18px; font-weight: 600; color: #111827; }
+.exec-summary .exec-copy-btn { margin-left: auto; }
 .exec-summary .exec-meta { font-size: 12px; color: #6b7280; }
 .exec-summary .exec-bullets { margin: 4px 0 0; padding-left: 22px; font-size: 13px; color: #374151; line-height: 1.6; }
 .exec-summary.exec-critical { border-color: #dc2626; }
@@ -347,14 +349,24 @@ function makeRelative(absPath, srcRoot) {
 	} catch { return absPath; }
 }
 
+// Présentation des coordonnées, déléguée au codec. Règle générique : le codec
+// fournit la coord canonique (maven "g:a", npm "name", composer "vendor/pkg"…) ;
+// Maven la porte déjà son namespace, les autres reçoivent un tag d'écosystème
+// ("npm:", "composer:", …) pour lever l'ambiguïté dans un report multi-eco.
+function codecFor(dep) { return getCodec(dep?.ecosystemType) || getCodec(dep?.ecosystem); }
+
 function depDisplayParts(dep) {
-	if (dep?.ecosystem === "npm") return { groupLine: "npm:", nameLine: dep.artifactId || "" };
-	return { groupLine: `${dep?.groupId ?? ""}:`, nameLine: dep?.artifactId || "" };
+	const c = codecFor(dep);
+	if (!c) return { groupLine: `${dep?.groupId ?? ""}:`, nameLine: dep?.artifactId || "" };
+	if (dep.ecosystem === "maven") return { groupLine: `${dep.namespace || dep.groupId || ""}:`, nameLine: dep.name || dep.artifactId || "" };
+	return { groupLine: `${dep.ecosystem}:`, nameLine: c.formatCoord(dep) };
 }
 
 function depDisplayName(dep) {
-	if (dep?.ecosystem === "npm") return `npm:${dep.artifactId || ""}`;
-	return `${dep?.groupId ?? ""}:${dep?.artifactId || ""}`;
+	const c = codecFor(dep);
+	if (!c) return `${dep?.groupId ?? ""}:${dep?.artifactId || ""}`;
+	const coord = c.formatCoord(dep);
+	return dep.ecosystem === "maven" ? coord : `${dep.ecosystem}:${coord}`;
 }
 
 const REF_LABELS = {
@@ -522,7 +534,7 @@ function renderDetailPanel(m) {
 
 	// 7. Declared-in POMs
 	if (dep.pomPaths?.length) {
-		const items = dep.pomPaths.slice(0, 10).map(p => `<div>${esc(p)}</div>`).join("");
+		const items = dep.pomPaths.slice(0, 10).map(p => `<div>${esc(makeRelative(p, RENDER_CTX.srcRoot))}</div>`).join("");
 		sections.push(section("Declared in",
 			`<div class="via-list">${items}${dep.pomPaths.length > 10 ? `<div style="color:#9ca3af">+${dep.pomPaths.length - 10} more</div>` : ""}</div>`,
 			{ count: `${dep.pomPaths.length} POM${dep.pomPaths.length > 1 ? "s" : ""}`, open: false }));
@@ -625,65 +637,9 @@ function renderCveTable(cveMatches, opts = {}) {
 	</table>`;
 }
 
-/**
- * Build a snippet of pom.xml the user can paste into their root POM's
- * <dependencyManagement> to pin a transitive to a safe version.
- */
-function dependencyManagementSnippet(items) {
-	const inner = items.map(it => `        <dependency>
-            <groupId>${esc(it.groupId)}</groupId>
-            <artifactId>${esc(it.artifactId)}</artifactId>
-            <version>${esc(it.fixVersion)}</version>
-        </dependency>`).join("\n");
-	return `<dependencyManagement>
-    <dependencies>
-${inner}
-    </dependencies>
-</dependencyManagement>`;
-}
-
-function npmOverridesSnippet(items) {
-	const lines = items.map(it => `    "${esc(it.artifactId)}": "${esc(it.fixVersion)}"`).join(",\n");
-	return `{
-  "overrides": {
-${lines}
-  }
-}`;
-}
-
-function yarnResolutionsSnippet(items) {
-	const lines = items.map(it => `    "${esc(it.artifactId)}": "${esc(it.fixVersion)}"`).join(",\n");
-	return `{
-  "resolutions": {
-${lines}
-  }
-}`;
-}
-
-// Per-ecosystem fix-recipe metadata. Keys correspond to ecosystemType values.
-const ECO_RECIPE = {
-	maven: {
-		label: "Maven",
-		pinSection: "A. Pin vulnerable transitives in <dependencyManagement>",
-		pinIntro: cnt => `Paste into the root POM to immediately neutralise ${cnt} transitive vulnerabilit${cnt > 1 ? "ies" : "y"}:`,
-		snippet: dependencyManagementSnippet,
-		directSection: "B. Or update the direct dependencies pulling them in",
-	},
-	npm: {
-		label: "npm",
-		pinSection: "A. Pin vulnerable transitives via npm overrides",
-		pinIntro: cnt => `Add to the root <code>package.json</code> and run <code>npm install</code> to force ${cnt} transitive${cnt > 1 ? "s" : ""} to a fixed version:`,
-		snippet: npmOverridesSnippet,
-		directSection: "B. Or update the direct dependencies (and run npm install)",
-	},
-	yarn: {
-		label: "Yarn",
-		pinSection: "A. Pin vulnerable transitives via yarn resolutions",
-		pinIntro: cnt => `Add to the root <code>package.json</code> and run <code>yarn install</code> to force ${cnt} transitive${cnt > 1 ? "s" : ""} to a fixed version:`,
-		snippet: yarnResolutionsSnippet,
-		directSection: "B. Or update the direct dependencies (and run yarn install)",
-	},
-};
+// Per-ecosystem fix-recipe metadata, now owned by the codecs (lib/codecs/recipes.js).
+// Keys correspond to ecosystemType values.
+const ECO_RECIPE = require("./codecs/recipes");
 
 /**
  * From CVE matches (split direct/transitive) + outdatedResults + resolvedDeps,
@@ -789,7 +745,9 @@ function renderFixRecommendations(recos, allMatches = [], outdatedResults = [])
 	}
 
 	// Group by ecosystemType so each tool gets its own pin/update advice.
-	const byEco = { maven: { trans: [], directs: [] }, npm: { trans: [], directs: [] }, yarn: { trans: [], directs: [] } };
+	// Buckets + order come from the codec registry (new ecosystems slot in).
+	const byEco = {};
+	for (const id of ORDER) byEco[id] = { trans: [], directs: [] };
 	for (const t of recos.transitivesList) {
 		const et = ecoTypeOf(t);
 		(byEco[et] || byEco.maven).trans.push(t);
@@ -799,7 +757,7 @@ function renderFixRecommendations(recos, allMatches = [], outdatedResults = [])
 		(byEco[et] || byEco.maven).directs.push(d);
 	}
 
-	const ecoOrder = ["maven", "npm", "yarn"];
+	const ecoOrder = ORDER;
 	const out = [directsSection];
 	let letterIdx = 0;
 	for (const eco of ecoOrder) {
@@ -1029,7 +987,7 @@ function summaryCards(stats, eol, obs, out, extra = {}) {
 function mergeMatches(matches) {
 	const byKey = new Map();
 	for (const m of matches) {
-		const key = `${m.dep.groupId}:${m.dep.artifactId}|${m.cve.id}`;
+		const key = `${m.dep.groupId}:${m.dep.artifactId}:${m.dep.version}|${m.cve.id}`;
 		if (!byKey.has(key)) {
 			// Deep-ish copy so we can mutate dep.viaPaths
 			byKey.set(key, { ...m, dep: { ...m.dep, viaPaths: m.dep.viaPaths ? [...m.dep.viaPaths] : (m.dep.via ? [m.dep.via] : []) } });
@@ -1150,7 +1108,7 @@ function renderRetireTable(matches) {
 	const rows = sorted.map(m => `<tr>
 		<td>${badge((m.cve.severity || "MEDIUM").toUpperCase())}</td>
 		<td class="dep">${esc(m.dep.artifactId)}<br><span style="color:#6b7280">${esc(m.dep.version || "?")}</span></td>
-		<td class="dep"><code class="path">${esc(m.dep.vendoredFile || "")}</code></td>
+		<td class="dep"><code class="path">${esc(makeRelative(m.dep.vendoredFile || "", RENDER_CTX.srcRoot))}</code></td>
 		<td class="cve">${m.cve.id?.startsWith("CVE-") ? `<a href="https://nvd.nist.gov/vuln/detail/${esc(m.cve.id)}" target="_blank" rel="noopener">${esc(m.cve.id)}</a>` : esc(m.cve.id)}</td>
 		<td class="dep">${esc(m.cve.fixVersion || "—")}</td>
 		<td class="desc">${esc(shortDesc(m.cve.description))}</td>
@@ -1161,7 +1119,22 @@ function renderRetireTable(matches) {
 	</table>`;
 }
 
-function renderExecutiveSummary({ projectInfo, prodStats, devStats, retireStats, eolResults, obsoleteResults, outdatedResults, warnings, totalDeps, topCriticalMatches }) {
+/**
+ * One "vulnerable to" clause for a match, in the format requested for the
+ * Word-pasteable summary: prefer the primary CWE ("CWE-79 : Cross-site
+ * Scripting"), fall back to the CVE id when no weakness is recorded.
+ */
+function execWeakness(m) {
+	const cwes = Array.isArray(m.cve.cwes) ? m.cve.cwes : [];
+	const primary = cwes.find(c => cweName(c)) || cwes[0];
+	if (primary) {
+		const label = cweName(primary);
+		return label ? `${primary} : ${label}` : primary;
+	}
+	return m.cve.id || "an unspecified weakness";
+}
+
+function renderExecutiveSummary({ projectInfo, prodStats, devStats, retireStats, eolResults, obsoleteResults, outdatedResults, warnings, totalDeps, topCriticalMatches, interactive = false }) {
 	const eolN = eolResults?.length || 0;
 	const obsN = obsoleteResults?.length || 0;
 	const outN = outdatedResults?.length || 0;
@@ -1204,10 +1177,59 @@ function renderExecutiveSummary({ projectInfo, prodStats, devStats, retireStats,
 		}).join("")}</ul>
 	</div>` : "";
 
+	// ---- Word-pasteable copy payload (built only for the interactive HTML) ----
+	let copyUi = "";
+	if (interactive) {
+		const stripTags = s => s.replace(/<[^>]+>/g, "");
+		const plainBullets = bullets.map(stripTags);
+		const top = topCriticalMatches || [];
+		const topSentences = top.map(m => ({
+			lib: depDisplayName(m.dep),
+			ver: m.dep.version || "?",
+			weakness: execWeakness(m),
+			crit: (m.cve.severity || "HIGH").toUpperCase(),
+		}));
+
+		// Plain-text version (text/plain) — exact bullet format requested.
+		const plainLines = [];
+		plainLines.push(`EXECUTIVE SUMMARY — ${level}`);
+		plainLines.push(`${totalDeps} dependencies scanned`);
+		plainLines.push("");
+		if (plainBullets.length) for (const b of plainBullets) plainLines.push(`- ${b}`);
+		else plainLines.push("- No findings detected.");
+		if (topSentences.length) {
+			plainLines.push("");
+			plainLines.push(`Top ${topSentences.length} most critical:`);
+			for (const t of topSentences) {
+				plainLines.push(`- The library "${t.lib}" version "${t.ver}" is vulnerable to "${t.weakness}" ( ${t.crit} )`);
+			}
+		}
+		const plainText = plainLines.join("\n");
+
+		// Rich version (text/html) — inline styles so Word keeps the formatting.
+		const richBullets = plainBullets.length
+			? `<ul style="margin:4px 0 0; padding-left:22px;">${plainBullets.map(b => `<li style="margin:2px 0;">${esc(b)}</li>`).join("")}</ul>`
+			: `<p style="margin:4px 0;">No findings detected.</p>`;
+		const richTop = topSentences.length
+			? `<p style="font-weight:bold; margin:12px 0 4px;">Top ${topSentences.length} most critical:</p>
+			<ul style="margin:0; padding-left:22px;">${topSentences.map(t =>
+				`<li style="margin:3px 0;">The library "<b>${esc(t.lib)}</b>" version "<b>${esc(t.ver)}</b>" is vulnerable to "<b>${esc(t.weakness)}</b>" ( ${esc(t.crit)} )</li>`).join("")}</ul>`
+			: "";
+		const richHtml = `<div style="font-family:Calibri,Arial,sans-serif; font-size:11pt; color:#1f2937;">`
+			+ `<p style="font-size:14pt; font-weight:bold; margin:0 0 2px;">Executive Summary — ${esc(level)}</p>`
+			+ `<p style="margin:0 0 8px; color:#4b5563;">${esc(totalDeps)} dependencies scanned</p>`
+			+ richBullets + richTop + `</div>`;
+
+		copyUi = `<button class="btn-copy exec-copy-btn" type="button" title="Copy the executive summary — paste it into Word with formatting preserved">📋 Copy summary</button>`
+			+ `<template class="exec-copy-rich">${richHtml}</template>`
+			+ `<textarea class="exec-copy-plain" aria-hidden="true" tabindex="-1" style="position:absolute;left:-9999px;top:0;width:1px;height:1px;opacity:0;">${esc(plainText)}</textarea>`;
+	}
+
 	return `<div class="exec-summary exec-${esc(level.toLowerCase())}">
 		<div class="exec-head">
 			<span class="exec-level">${esc(level)}</span>
 			<span class="exec-title">Executive Summary</span>
+			${copyUi}
 		</div>
 		<div class="exec-meta">${esc(totalDeps)} dependencies scanned</div>
 		<ul class="exec-bullets">
@@ -1248,7 +1270,7 @@ function renderWarningItems(items, itemLimit) {
 		const id = it.id || "";
 		const paths = (it.manifestPaths || []).slice(0, 6);
 		const pathsHtml = paths.length
-			? `<div class="warn-defined">defined in: ${paths.map(p => `<code class="path">${esc(p)}</code>`).join(", ")}${it.manifestPaths.length > paths.length ? ` <span class="warn-defined-more">+${it.manifestPaths.length - paths.length} more</span>` : ""}</div>`
+			? `<div class="warn-defined">defined in: ${paths.map(p => `<code class="path">${esc(makeRelative(p, RENDER_CTX.srcRoot))}</code>`).join(", ")}${it.manifestPaths.length > paths.length ? ` <span class="warn-defined-more">+${it.manifestPaths.length - paths.length} more</span>` : ""}</div>`
 			: "";
 		return `<li><code>${esc(id)}</code>${pathsHtml}</li>`;
 	}).join("");
@@ -1298,6 +1320,7 @@ function buildBody({ cveMatches, devCveMatches, retireMatches, eolResults, obsol
 		eolResults, obsoleteResults, outdatedResults,
 		warnings, totalDeps: resolvedDeps?.size || 0,
 		topCriticalMatches: pickTopCriticalMatches(prodMatchesActive, retireMatches, 5),
+		interactive: wrapTables, // copy button + scripts only in the HTML output
 	});
 
 	// (C) Table of contents — rendered as a sticky nav. Only enumerates the
@@ -1364,7 +1387,7 @@ function pickTopCriticalMatches(prodMatches, retireMatches, n) {
 	const out = [];
 	for (const m of all) {
 		const dep = m.dep;
-		const k = `${dep.ecosystem === "npm" ? "npm:" : dep.groupId + ":"}${dep.artifactId}`;
+		const k = dep.coordKey || `${dep.ecosystem === "npm" ? "npm:" : dep.groupId + ":"}${dep.artifactId}`;
 		if (seen.has(k)) continue;
 		seen.add(k);
 		out.push(m);
@@ -1393,12 +1416,17 @@ function renderFalsePositives(matches) {
 	return intro + renderCveTable(matches);
 }
 
-const ECO_LABELS = { maven: "Maven", npm: "npm (package-lock)", yarn: "Yarn" };
-const ECO_MANIFEST_KIND = { maven: "pom.xml", npm: "package-lock.json", yarn: "yarn.lock" };
+// Derived from the codec registry. Overrides keep the exact legacy wording where
+// a codec's plain label/lockfile isn't what the report historically showed.
+const ECO_LABEL_OVERRIDE = { npm: "npm (package-lock)" };
+const ECO_MANIFEST_OVERRIDE = { maven: "pom.xml", npm: "package-lock.json", yarn: "yarn.lock" };
+const ECO_LABELS = Object.fromEntries(allCodecs().map(c => [c.id, ECO_LABEL_OVERRIDE[c.id] || c.label]));
+const ECO_MANIFEST_KIND = Object.fromEntries(allCodecs().map(c => [c.id, ECO_MANIFEST_OVERRIDE[c.id] || c.manifestNames[c.manifestNames.length - 1]]));
 
 function renderCveBySectionByEco(matches, chapterPrefix, srcRoot) {
-	const ecoOrder = ["maven", "npm", "yarn"];
-	const byEco = { maven: [], npm: [], yarn: [] };
+	const ecoOrder = ORDER;
+	const byEco = {};
+	for (const id of ORDER) byEco[id] = [];
 	for (const m of matches) {
 		const et = m.dep?.ecosystemType || (m.dep?.ecosystem === "npm" ? "npm" : "maven");
 		(byEco[et] || byEco.maven).push(m);
@@ -1488,31 +1516,32 @@ const COPY_SCRIPT = `
 			btn.classList.remove(cls);
 		}, 1500);
 	}
-	async function copyTable(table, btn){
-		var clone = inlineStylesForWord(table);
-		var html = wordWrapper(clone.outerHTML);
-		var tsv = tableToTsv(table);
+	// Write rich HTML (+ plain-text fallback) to the clipboard. Shared by the
+	// table buttons and the executive-summary button. richInner is the HTML
+	// fragment; we wrap it with the Office namespaces so Word keeps formatting.
+	async function writeClipboard(richInner, plain, btn){
+		var html = wordWrapper(richInner);
 		// Modern path: ClipboardItem with text/html + text/plain
 		try {
 			if (window.ClipboardItem && navigator.clipboard && navigator.clipboard.write) {
 				await navigator.clipboard.write([
 					new ClipboardItem({
-						'text/html':  new Blob([html], { type: 'text/html'  }),
-						'text/plain': new Blob([tsv],  { type: 'text/plain' })
+						'text/html':  new Blob([html],  { type: 'text/html'  }),
+						'text/plain': new Blob([plain], { type: 'text/plain' })
 					})
 				]);
 				flash(btn, 'flashing-ok', '✓ Copied!');
 				return;
 			}
 		} catch(e) { /* fall through to legacy path */ }
-		// Legacy path: select clone, execCommand('copy') — gets the HTML
+		// Legacy path: select a contenteditable clone, execCommand('copy')
 		try {
 			var temp = document.createElement('div');
 			temp.setAttribute('contenteditable', 'true');
 			temp.style.position = 'fixed';
 			temp.style.left = '-9999px';
 			temp.style.top = '0';
-			temp.innerHTML = clone.outerHTML;
+			temp.innerHTML = richInner;
 			document.body.appendChild(temp);
 			var range = document.createRange();
 			range.selectNodeContents(temp);
@@ -1527,7 +1556,14 @@ const COPY_SCRIPT = `
 			flash(btn, 'flashing-err', '✗ Copy failed');
 		}
 	}
+	function copyTable(table, btn){
+		var clone = inlineStylesForWord(table);
+		return writeClipboard(clone.outerHTML, tableToTsv(table), btn);
+	}
 	document.querySelectorAll('.btn-copy').forEach(function(btn){
+		// The executive-summary button is wired separately (it copies a prose
+		// summary, not a table).
+		if (btn.classList.contains('exec-copy-btn')) return;
 		btn.addEventListener('click', function(e){
 			e.stopPropagation();
 			var wrap = btn.closest('.table-wrap');
@@ -1535,6 +1571,15 @@ const COPY_SCRIPT = `
 			if (table) copyTable(table, btn);
 		});
 	});
+	var execBtn = document.querySelector('.exec-copy-btn');
+	if (execBtn) execBtn.addEventListener('click', function(e){
+		e.stopPropagation();
+		var tpl = document.querySelector('.exec-copy-rich');
+		var ta = document.querySelector('.exec-copy-plain');
+		var rich = tpl ? (tpl.innerHTML || '') : '';
+		var plain = ta ? (ta.value || '') : '';
+		writeClipboard(rich, plain, execBtn);
+	});
 })();
 </script>`;
 
@@ -1760,5 +1805,7 @@ module.exports = {
 	generateHtmlReport,
 	generateWordReport,
 	writeReports,
+	depDisplayName,
+	depDisplayParts,
 	esc,
 };

package/lib/dep-record.js

@@ -0,0 +1,60 @@
+/**
+ * lib/dep-record.js — contrat de données unifié partagé par tous les codecs.
+ *
+ * `coordKey` est la clé de la Map résolue ; elle ne collisionne jamais entre
+ * écosystèmes grâce au préfixe `ecosystem:`. `groupId`/`artifactId`/`pomPaths`
+ * sont conservés comme alias rétro-compat le temps de migrer tous les
+ * consommateurs vers `namespace`/`name`/`manifestPaths`.
+ */
+
+// NuGet, Composer et PyPI sont case-insensitive : on normalise la clé en lower
+// (l'affichage garde la casse d'origine via dep.name).
+function normalizeForKey(ecosystem, s) {
+	if (ecosystem === "nuget" || ecosystem === "composer" || ecosystem === "pypi") return String(s).toLowerCase();
+	return s;
+}
+
+// La clé de la Map résolue.
+// - Maven : clé BRUTE "g:a" (pas de préfixe "maven:"). Collision-free face aux
+//   préfixes des autres écosystèmes (un groupId reverse-DNS ne commence jamais
+//   par "npm:"/"nuget:"/…), et ça garde transitive.js + les tests inchangés.
+// - npm : "npm:<name>" où name peut inclure le scope (@org/pkg) — namespace reste "".
+// - composer : "composer:vendor/pkg". pypi/nuget : "<eco>:<name>".
+function coordKeyFor(ecosystem, namespace, name) {
+	if (ecosystem === "maven") {
+		const g = namespace || "";
+		return g ? `${g}:${name}` : name;
+	}
+	const ns = normalizeForKey(ecosystem, namespace || "");
+	const nm = normalizeForKey(ecosystem, name || "");
+	const joined = ns ? `${ns}/${nm}` : nm;
+	return `${ecosystem}:${joined}`;
+}
+
+function makeDepRecord(input) {
+	const { ecosystem, namespace = "", name, version = null, manifestPath, scope = "compile", isDev = false, ecosystemType } = input;
+	const concrete = version && !/\$\{/.test(version) ? version : null;
+	const manifestPaths = manifestPath ? [manifestPath] : [];
+	return {
+		ecosystem,
+		ecosystemType: ecosystemType || ecosystem,
+		namespace: namespace || "",
+		name,
+		version: version || null,
+		versions: concrete ? [concrete] : [],
+		coordKey: coordKeyFor(ecosystem, namespace, name),
+		scope,
+		isDev: !!isDev,
+		manifestPaths,
+		// Alias rétro-compat : CHAMPS DUPLIQUÉS RÉELS (pas des getters — les depRecords
+		// sont spreadés dans des chemins chauds : cve-match.js:175, scan-completeness.js,
+		// cve-report.js:1036, snyk.js:105 — un getter serait perdu au spread).
+		// groupId/artifactId sont des strings jamais réassignées → pas de dérive.
+		// pomPaths PARTAGE la référence de manifestPaths → les push restent synchrones.
+		groupId: namespace || "",
+		artifactId: name,
+		pomPaths: manifestPaths,
+	};
+}
+
+module.exports = { makeDepRecord, coordKeyFor };

package/lib/osv.js

@@ -96,8 +96,18 @@ function pickPrimaryId(vuln) {
 	return cveAlias || vuln.id;
 }
 
-/** Build the OSV package-name key for a dep (Maven uses g:a, npm uses bare name). */
+// OSV ecosystem name per codec id. OSV.dev natively supports all of these.
+const OSV_ECO = { maven: "Maven", npm: "npm", yarn: "npm", nuget: "NuGet", composer: "Packagist", pypi: "PyPI" };
+
+/** OSV ecosystem string for a dep, derived from its codec id. */
+function osvEcosystemFor(dep) { return OSV_ECO[dep.ecosystem] || "Maven"; }
+
+/** Build the OSV package-name key for a dep — delegated to the dep's codec. */
 function osvPkgName(dep) {
+	const { getCodec } = require("./codecs");
+	const c = getCodec(dep.ecosystem);
+	if (c) return c.osvPackageName(dep);
+	// Fallback historique si le codec est introuvable.
 	return dep.ecosystem === "npm" ? dep.artifactId : `${dep.groupId}:${dep.artifactId}`;
 }
 
@@ -155,11 +165,10 @@ async function queryBatch(deps, opts = {}) {
 			indexMap[i] = { cached: hit };
 		} else {
 			indexMap[i] = { queryIdx: queries.length, cacheKey: ck };
-			// Ecosystem-aware query: OSV uses "npm" for npm packages (name only,
-			// no groupId), "Maven" for Maven (name = "g:a"). The dep record's
-			// `ecosystem` field defaults to "maven" — npm collector sets "npm".
-			const ecosystem = d.ecosystem === "npm" ? "npm" : "Maven";
-			const pkgName = ecosystem === "npm" ? d.artifactId : `${d.groupId}:${d.artifactId}`;
+			// Ecosystem + package name are both derived from the dep's codec, so
+			// adding a new ecosystem (NuGet/Packagist/PyPI) needs no change here.
+			const ecosystem = osvEcosystemFor(d);
+			const pkgName = osvPkgName(d);
 			queries.push({
 				package: { name: pkgName, ecosystem },
 				version: d.version,
@@ -295,20 +304,23 @@ function runMatches(deps, indexMap, detailById) {
 async function queryOsvForDeps(resolvedDeps, opts = {}) {
 	const deps = [];
 	for (const d of resolvedDeps.values()) {
-		if (!d.version || /\$\{|SNAPSHOT/i.test(d.version)) continue;
 		if (d.scope === "parent") continue; // parents don't have OSV entries typically
-		// npm version specifiers like "^1.0.0" can't be queried against OSV — need
-		// a concrete version. Lockfiles always provide one; package.json-only deps
-		// are skipped here.
-		if (d.ecosystem === "npm" && /^[\^~>=<*]|^(latest|next|workspace:|git\+|file:|link:)/.test(d.version)) continue;
-		deps.push({
-			groupId: d.groupId, artifactId: d.artifactId, version: d.version,
-			scope: d.scope, via: d.via, depth: d.depth, pomPaths: d.pomPaths,
-			manifestPaths: d.manifestPaths,
-			ecosystem: d.ecosystem || "maven",
-			ecosystemType: d.ecosystemType,
-			isDev: !!d.isDev,
-		});
+		// Query every distinct concrete version (e.g. two profiles pinning the
+		// same g:a), not just the representative highest — otherwise a vuln that
+		// only affects a lower-versioned variant would be missed.
+		const versions = (d.versions && d.versions.length) ? d.versions : [d.version];
+		for (const ver of versions) {
+			if (!ver || /\$\{|SNAPSHOT/i.test(ver)) continue;
+			// npm version specifiers like "^1.0.0" can't be queried against OSV —
+			// need a concrete version. Lockfiles always provide one; package.json-
+			// only deps are skipped here.
+			if (d.ecosystem === "npm" && /^[\^~>=<*]|^(latest|next|workspace:|git\+|file:|link:)/.test(ver)) continue;
+			// Spread the whole depRecord (carries namespace/name/coordKey, which the
+			// codec's osvPackageName + the report's dedup rely on) and override only
+			// the version for this per-version query. Cherry-picking fields here used
+			// to drop name/namespace → OSV queried `undefined` for composer/pypi/nuget.
+			deps.push({ ...d, version: ver });
+		}
 	}
 	return queryBatch(deps, opts);
 }
@@ -319,5 +331,7 @@ module.exports = {
 	vulnToMatch,
 	severityFromOsv,
 	fixVersionFromOsv,
+	osvEcosystemFor,
+	osvPkgName,
 	OSV_CACHE_DIR,
 };

package/lib/outdated.js

@@ -9,7 +9,7 @@ const fs = require("fs");
 const path = require("path");
 const os = require("os");
 const { compareMavenVersions } = require("./maven-version");
-const { webjarToNpm } = require("./npm/collect");
+const { webjarToNpm } = require("./codecs/npm/collect");
 
 const KNOWN_OBSOLETE = require("../data/known-obsolete.json");
 const EOL_MAPPING = require("../data/eol-mapping.json");
@@ -57,6 +57,16 @@ function findEolProduct(dep) {
 		}
 		return null;
 	}
+	if (dep.ecosystem === "composer") {
+		const full = `${dep.namespace || dep.groupId || ""}/${dep.name || dep.artifactId}`.toLowerCase();
+		return EOL_MAPPING.by_composer_name?.[full] || null;
+	}
+	if (dep.ecosystem === "pypi") {
+		return EOL_MAPPING.by_pypi_name?.[(dep.name || dep.artifactId || "").toLowerCase()] || null;
+	}
+	if (dep.ecosystem === "nuget") {
+		return EOL_MAPPING.by_nuget_name?.[(dep.name || dep.artifactId || "").toLowerCase()] || null;
+	}
 	const key = `${dep.groupId}:${dep.artifactId}`;
 	const direct = EOL_MAPPING.by_group_artifact?.[key];
 	if (direct) return direct;
@@ -245,7 +255,8 @@ async function checkOutdatedDeps(resolvedDeps, opts = {}) {
 	const cache = loadJsonCache(VERSION_CACHE_PATH);
 	const fresh = cache.meta?.fetchedAt && (Date.now() - cache.meta.fetchedAt) < VERSION_CACHE_MAX_AGE_MS;
 	if (!fresh && !offline) cache.entries = {};
-	const list = [...resolvedDeps.values()].filter(d => d.version && !/\$\{|SNAPSHOT/i.test(d.version) && d.ecosystem !== "npm");
+	// Maven Central only — npm/composer/pypi/nuget have their own registries (codec.checkRegistry).
+	const list = [...resolvedDeps.values()].filter(d => d.version && !/\$\{|SNAPSHOT/i.test(d.version) && d.ecosystem === "maven");
 	const results = [];
 
 	// Progress indicator — Maven Central can serve hundreds of deps in a few

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fad-checker",
-  "version": "1.0.5",
-  "description": "Fucking Autonomous Dependency Checker — Scans ALL pom/bom, npm/Yarn stuff and vendored JavaScript in a source tree, deal with private deps, multi modules & produces 1 HTML/DOC report with CVE, EOL, obsolete, outdated deps & fix recos",
+  "version": "2.0.0",
+  "description": "Scans ALL Maven, npm, Yarn, Composer, Python, C#/.NET in a source tree ONE SHOT Alone like a big boy, deal with private deps, multi mvn modules, EOL, obsolete, outdated deps & give fix recos",
   "license": "MIT",
   "repository": "https://github.com/n8tz/fad-checker",
   "author": "pp9Ping <pp9Ping@gmail.com>",
@@ -28,6 +28,7 @@
     "p-limit": "^3.1.0",
     "retire": "^5.4.2",
     "rimraf": "^6.0.1",
+    "smol-toml": "^1.6.1",
     "xml2js": "^0.6.2"
   },
   "engines": {

package/test/cli-ecosystem.test.js

@@ -0,0 +1,30 @@
+const test = require("node:test");
+const assert = require("node:assert");
+const { resolveActiveCodecs } = require("../lib/codecs/select");
+
+test("resolveActiveCodecs parses comma list and 'all'", () => {
+	const all = ["maven", "npm", "nuget", "composer", "pypi"];
+	assert.deepStrictEqual(resolveActiveCodecs("maven,pypi", all, {}), ["maven", "pypi"]);
+	assert.deepStrictEqual(resolveActiveCodecs("all", all, {}), all);
+	assert.deepStrictEqual(resolveActiveCodecs("auto", all, {}), all);
+});
+
+test("resolveActiveCodecs honors --no-<id> flags", () => {
+	const all = ["maven", "npm", "nuget"];
+	assert.deepStrictEqual(resolveActiveCodecs("all", all, { noCodecs: ["npm"] }), ["maven", "nuget"]);
+});
+
+test("--no-js aliases to npm+yarn", () => {
+	const all = ["maven", "npm", "yarn", "nuget"];
+	assert.deepStrictEqual(resolveActiveCodecs("all", all, { noJs: true }), ["maven", "nuget"]);
+});
+
+test("legacy 'both' maps to maven+npm/yarn only", () => {
+	const all = ["maven", "npm", "yarn", "nuget", "pypi"];
+	assert.deepStrictEqual(resolveActiveCodecs("both", all, {}), ["maven", "npm", "yarn"]);
+});
+
+test("explicit list intersects with available (auto-detect)", () => {
+	const detected = ["maven"];   // only maven detected on this tree
+	assert.deepStrictEqual(resolveActiveCodecs("maven,npm", detected, {}), ["maven"]);
+});